# Permission-aware RAG is an identity project > An employee should not learn a confidential policy from an AI answer if they cannot open the document itself. Access rules need to apply throughout the search and answer process. Canonical URL: https://marmation.com/review/permission-aware-enterprise-rag/ By Vikram Roy · 2026-11-12 A knowledge assistant can reveal a confidential decision without ever displaying the original file. When it searches company documents to prepare an answer, the search must obey the same access rights as the documents themselves. Otherwise the assistant becomes a new route around existing controls. An employee asks a knowledge assistant about a confidential reorganization. The model has never seen the underlying file directly, but the retrieval index has. If the assistant supplies a summary to a user who cannot access that file, the problem is not hallucination. It is an authorization failure. ## Check access before the answer is written Many teams focus first on embeddings, chunk size and model choice. Those details matter, but they come after the security question: whose identity does the retrieval request represent, and which source documents may that person use? Indexing data can create a second information-access path. Permission checks cannot be deferred until after the model generates its answer, because the restricted material has already entered the context. ## Carry the employee’s rights through the search Retrieval-augmented generation (RAG) finds relevant company material for a model to use in its answer. Use the company’s trusted sign-in system to identify the employee. Carry each document’s list of permitted users and groups—its access-control list (ACL)—into search, and exclude restricted passages before they reach the model. Keep customer companies separate, and account for the delay between a permission changing in the source and that change reaching search. Citations should point only to sources the user may open. Caches, which reuse earlier results, must distinguish users’ access rights so they do not disclose one person’s answer to another. A good answer from the wrong document is still unacceptable. ## Test two people with different access Test two users with deliberately different entitlements and one document that changes from accessible to restricted. Check retrieved snippets, citations, generated summaries, logs and caches. Then test a removed group membership and a source whose access-control list has not yet synchronized. That sequence tells an architect more than a broad retrieval accuracy score. ## When the existing platform already does the job If the existing enterprise platform already enforces source permissions correctly for the target content and use case, there may be no good reason to build a bespoke retrieval layer. The client should still verify whose access each connector uses and how quickly a source or permission change takes effect. Custom development is most justified when the required behavior, sources or access rules differ materially from what a packaged product supports. ## Ask for an access test before a search database Before choosing a search database, including a vector store for meaning-based search, require a map of users and permissions, a test that removes access, documented source authority, an answer-with-citation test and an explicit safe no-answer state. Review what data enters the model context and how it is logged. ### References and context [Microsoft Learn, document-level access control](); [Microsoft Learn security practices](). Review preview status at implementation. ## Sources - [Azure AI Search document-level access]() — Microsoft Learn. Enterprise search can align retrieval to source document permissions when correctly configured. Azure AI Search can support document access patterns; verify identity/preview limitations Limit: Access protection depends on the original permissions, connectors and configuration. Product features and preview status may change; check the version being used. ## Related reading - [From working prototype to dependable system](https://marmation.com/review/engineering/) - [Design the action boundary before designing the agent.](https://marmation.com/review/designing-an-agent-with-bounded-actions/) - [Engineering autonomy is a control design problem.](https://marmation.com/review/engineering-autonomy-is-a-control-design/)